Black Iris is the AI engine behind identiqa Intelligence. Built for forensic analysis, attribution, and post-incident reconstruction — for law enforcement, government investigators, and incident response teams who need answers that hold up in court.
A defense engine optimizes for one thing: stop the attack before it lands. Speed over certainty, decisions over evidence. That's how Aura works — and that's the right choice for a perimeter.
Investigation is the opposite job. You already know something happened. Now you need to know what, by whom, in what sequence, with what evidence — to a standard that survives review by lawyers, judges, parliamentary committees, and adversaries with deep pockets and good attorneys.
Black Iris is built for that second job. It's not Aura with a different label. It's a different model with different priorities.
We deliberately built two specialist models rather than one stretched thin. Here's how they differ.
Six capabilities that map directly to the work investigators do. Each produces structured evidence — not just dashboards.
Reconstructs attack timelines from logs, network captures, disk artifacts, and memory dumps. Identifies what happened, in what order, on what systems.
Continuous correlation across thousands of indicators — campaign patterns, infrastructure overlap, malware family signatures — to position individual incidents in the broader threat landscape.
Live investigation support during active incidents. Containment recommendations, spread analysis, exfiltration tracking — all aligned with NIST SP 800-61 and ISO 27035 frameworks.
Maps technical artifacts to known threat actors using infrastructure fingerprints, code lineage, tradecraft patterns, and language analysis. Confidence levels are explicit, never inflated.
Surveils underground markets, leak sites, ransomware blogs, and closed forums for stolen data, credential dumps, and emerging threats targeting your jurisdiction or constituents.
Periodic intelligence briefings tailored to leadership audiences — government, judiciary, executives. Translates technical findings into operational and policy implications.
How a typical investigation flows through Black Iris. Every step produces an artifact with verified integrity that can be presented in court or to oversight bodies.
Logs, packet captures, disk images, memory dumps, malware samples — ingested with cryptographic chain-of-custody from the first moment.
Black Iris correlates artifacts across systems and time, building a coherent attack timeline with confidence levels for each inferred event.
Cross-references infrastructure, tradecraft, and code lineage against threat actor profiles. Each match is graded — high, medium, low confidence — with explicit reasoning.
All artifacts, analyses, and inferences are bundled into a court-ready package — with integrity hashes, audit logs, and methodology documentation included by default.
Package handed to investigators, prosecutors, or oversight committees. Methodology is fully documented for adversarial review — no black-box claims.
The most damaging thing in court isn't a weak case. It's a strong case undermined by sloppy chain-of-custody. Black Iris is engineered so every artifact, every inference, every action is verifiable end-to-end.
No black boxes. If a defendant's lawyer asks how the model reached a conclusion, we can produce the input, the model version, the inference parameters, the confidence factors, and the methodology — every time.
National and federal cybercrime divisions investigating ransomware groups, financial fraud rings, and cross-border attacks. Evidence packages structured for prosecutorial review and judicial admissibility.
Computer emergency response teams operating under government mandate. Black Iris supports incident analysis at scale, threat actor tracking, and strategic intelligence briefings for ministerial audiences.
Operators of critical infrastructure under NIS2 and national equivalents. When the regulator asks "what happened," Black Iris produces the answer with the evidence to back it up.
Digital forensics and incident response firms operating on behalf of clients. Black Iris accelerates investigation cycles and standardizes evidence quality across consultants and engagements.
Defense ministries and intelligence services with sovereignty requirements beyond ordinary government. Available in air-gapped, fully on-premise configurations under separate licensing.
Investigative committees examining state-level cyber incidents, election interference, or critical infrastructure failures. Black Iris evidence methodology is structured for political and judicial scrutiny alike.
Black Iris is not sold through public channels. Engagements begin with a verified-credentials conversation under NDA — typically with cybercrime units, national CERTs, regulated incident response firms, or government bodies with legitimate investigative mandate.